Cross-Area Approaches to Innovative Security Solutions
- 5 views
Wednesday, March 21, 2018 - 10:15 am
Innovation Center, Room 2277
COLLOQUIUM
Qiang Zeng
Abstract
By applying out-of-the-box thinking and cross-area approaches, novel solutions can be innovated to solve challenging problems. In this talk, I will share my experiences in applying cross-area approaches, and present creative designs to solve two difficult security problems.
Problem 1: Decentralized Android Application Repackaging Detection. An unethical developer can download a mobile application, make arbitrary modifications (e.g., inserting malicious code and replacing the advertisement library), repackage the app, and then distribute it; the attack is called application repackaging. Such attacks have posed severe threats, causing $14 billion monetary loss annually and propagating over 80% of mobile malware. Existing countermeasures are mostly centralized and imprecise. We consider building the repackaging detection capability into apps, such that user devices are made use of to detect repackaging in a decentralized fashion. In order to protect repackaging detection code from attacks, we propose a creative use of logic bombs, which are commonly used in malware. The use of hacking techniques for benign purposes has delivered an innovative and effective defense technique. Problem 2: Precise Binary Code Semantics Extraction. Binary code analysis allows one to analyze a piece of binary code without accessing the corresponding source code. It is widely used for vulnerability discovery, dissecting malware, user-side crash analysis, etc. Today, binary code analysis becomes more important than ever. With the booming development of the Internet-of-Things industry, a sheer number of firmware images of IoT devices can be downloaded from the Internet. It raises challenges for researchers, third-party companies, and government agents to analyze these images at scale, without access to the source code, for identifying malicious programs, detecting software plagiarism, and finding vulnerabilities. I will introduce a brand new binary code analysis technique that learns from Natural Language Processing, an area remote from code analysis, to extract useful semantic information from binary code.
Dr. Qiang Zeng is an Assistant Professor in the Department of Computer & Information Sciences at Temple University. He received his Ph.D. in Computer Science and Engineering from the Pennsylvania State University, and his B.E. and M.E. degrees in Computer Science and Engineering from Beihang University, China. He has rich industry experiences and ever worked in the IBM T.J. Watson Research Center, the NEC Lab America, Symantec and Yahoo.
Dr. Zeng’s main research interest is Systems and Software Security. He currently works on IoT Security, Mobile Security, and deep learning for solving security problems. He has published papers in PLDI, NDSS, MobiSys, CGO, DSN and TKDE.
Date: Mar. 21 2018
Time: 10:15-11:15 am
Place: Innovation Center, Room 2277
Qiang Zeng
Abstract
By applying out-of-the-box thinking and cross-area approaches, novel solutions can be innovated to solve challenging problems. In this talk, I will share my experiences in applying cross-area approaches, and present creative designs to solve two difficult security problems.
Problem 1: Decentralized Android Application Repackaging Detection. An unethical developer can download a mobile application, make arbitrary modifications (e.g., inserting malicious code and replacing the advertisement library), repackage the app, and then distribute it; the attack is called application repackaging. Such attacks have posed severe threats, causing $14 billion monetary loss annually and propagating over 80% of mobile malware. Existing countermeasures are mostly centralized and imprecise. We consider building the repackaging detection capability into apps, such that user devices are made use of to detect repackaging in a decentralized fashion. In order to protect repackaging detection code from attacks, we propose a creative use of logic bombs, which are commonly used in malware. The use of hacking techniques for benign purposes has delivered an innovative and effective defense technique. Problem 2: Precise Binary Code Semantics Extraction. Binary code analysis allows one to analyze a piece of binary code without accessing the corresponding source code. It is widely used for vulnerability discovery, dissecting malware, user-side crash analysis, etc. Today, binary code analysis becomes more important than ever. With the booming development of the Internet-of-Things industry, a sheer number of firmware images of IoT devices can be downloaded from the Internet. It raises challenges for researchers, third-party companies, and government agents to analyze these images at scale, without access to the source code, for identifying malicious programs, detecting software plagiarism, and finding vulnerabilities. I will introduce a brand new binary code analysis technique that learns from Natural Language Processing, an area remote from code analysis, to extract useful semantic information from binary code.
Dr. Qiang Zeng is an Assistant Professor in the Department of Computer & Information Sciences at Temple University. He received his Ph.D. in Computer Science and Engineering from the Pennsylvania State University, and his B.E. and M.E. degrees in Computer Science and Engineering from Beihang University, China. He has rich industry experiences and ever worked in the IBM T.J. Watson Research Center, the NEC Lab America, Symantec and Yahoo.
Dr. Zeng’s main research interest is Systems and Software Security. He currently works on IoT Security, Mobile Security, and deep learning for solving security problems. He has published papers in PLDI, NDSS, MobiSys, CGO, DSN and TKDE.
Date: Mar. 21 2018
Time: 10:15-11:15 am
Place: Innovation Center, Room 2277
COLLOQUIUM
Speaker: Heewook Lee
Abstract: Genetic diversity is necessary for survival and adaptability of all forms of life. The importance of genetic diversity is observed universally in humans to bacteria. Therefore, it is a central challenge to improve our ability to identify and characterize the extent of genetic variants in order to understand the mutational landscape of life. In this talk, I will focus on two important instances of genetic diversity found in (1) human genomes (particularly the human leukocyte antigens—HLA) and (2) bacterial genomes (rearrangement of insertion sequence [IS] elements). I will first show that specific graph data structures can naturally encode high levels of genetic variation, and I will describe our novel, efficient graph-based computational approaches to identify genetic variants for both HLA and bacterial rearrangements. Each of these methods is specifically tailored to its own problem, making it possible to achieve the state-of-the-art performance. For example, our method is the first to be able to reconstruct full-length HLA sequences from short-read sequence data, making it possible to discover novel alleles in individuals. For IS element rearrangement, I used our new approach to provide the first estimate of genome-wide rate of IS-induced rearrangements including recombination. I will also show the spatial patterns and the biases that we find by analyzing E. coli mutation accumulation data spanning over 2.2 million generations. These graph-centric ideas in our computational approaches provide a foundation for analyzing genetically heterogeneous populations of genes and genomes, and provide directions for ways to investigate other instances of genetic diversity found in life.
Bio: Dr. Heewook Lee is currently a Lane Fellow at Computational Biology Department at the School of Computer Science in Carnegie Mellon University, where he works on developing novel assembly algorithms for reconstructing highly diverse immune related genes, including human leukocyte antigens. He received a B.S. in computer science from Columbia University, and obtained M.S. and Ph.D in computer science from Indiana University. Prior to his graduate studies, he also worked as a bioinformatics scientist at a sequencing center/genomics company where he was in charge of the computational unit responsible for carrying out various microbial genome projects and Korean Human Genome project.
Mar. 16 2018
Location: Innovation Center, Room 2277
Time: 10:15 - 11:15 AM
Soteris Demetriou
Abstract
In contrast with traditional ubiquitous computing, mobile devices are now user-facing, more complex and interconnected. Thus they introduce new attack surfaces, which can result in severe private information leakage. Due to the rapid adoption of smart devices, there is an urgent need to address emerging security and privacy challenges to help realize the vision of a secure, smarter and personalized world.
In this talk, I will focus on the smartphone and its role in smart environments. First I will show how the smartphone's complex architecture allows third-party applications and advertising networks to perform inference attacks and compromise user confidentiality. Further, I will demonstrate how combining techniques from both systems and data sciences can help us build tools to detect such leakage. Second, I will show how a weak mobile application adversary can exploit vulnerabilities hidden in the interplay between smartphones and smart devices. I will then describe how we can leverage both strong mandatory access control and flexible user-driven access control to design practical and robust systems to mitigate such threats. I will conclude, by discussing how in the future I want to enable a trustworthy Internet of Things, focusing not only on strengthening smartphones, but also emerging intelligent platforms and environments (e.g. automobiles, smart buildings/cities), and new user interaction modalities in IoT (acoustic signals).
Soteris Demetriou is a Ph.D. Candidate in Computer Science at the University of Illinois at Urbana- Champaign. His research interests lie at the intersection of mobile systems and, security and privacy, with a current focus on smartphones and IoT environments. He discovered side-channels in the virtual process filesystem (procfs) of the Linux kernel that can be exploited by malicious applications running on Android devices; he built Pluto, an open-source tool for detection of sensitive user information collected by mobile apps; he designed security enhancements for the Android OS which enable mandatory and discretionary access control for external devices. His work incited security additions in the popular Android operating system, has received a distinguished paper award at NDSS, and is recognized by awards bestowed by Samsung Research America and Hewlett-Packard Enterprise. Soteris is a recipient of the Fulbright Scholarship, and in 2017 was selected by the Heidelberg Laureate Forum as one of the 200 most promising young researchers in the fields of Mathematics and Computer Science.
Date: Mar. 14, 2018
Time: 10:15-11:15 am
Place: Innovation Center, Room 2277
Antonios Argyriou
Abstract
The next generation of cellular wireless communication systems (WCS) aspire to become a paradigm shift and not just an incremental version of existing systems. These systems will come along with several technical and conceptual advances resulting in an ecosystem that aims to deliver orders of magnitude higher performance (throughput, delay, energy). These systems will essentially serve as conduits among service/content providers and users, and are expected to support a significantly enlarged and diversified bouquet of applications.
In this talk we will first introduce the audience to the fundamental concepts of WCS that brought us to this day. Subsequently, we will identify the application trends that drive specific design choices of future WCS. Then, we will present a new idea for designing and optimizing future WCS that puts the specific application at the focus of our choices. The discussion will be based on two key application categories namely wireless monitoring, and video delivery. In the last part of this talk we will discuss how this paradigm, that elevates the role of the applications, opens up new directions for understanding, operating, and designing future WCS..
Dr. Antonios Argyriou received the Diploma in electrical and computer engineering from Democritus University of Thrace, Greece, in 2001, and the M.S. and Ph.D. degrees in electrical and computer engineering as a Fulbright scholar from the Georgia Institute of Technology, Atlanta, USA, in 2003 and 2005, respectively. Currently, he is an Assistant Professor at the department of electrical and computer engineering, University of Thessaly, Greece. From 2007 until 2010 he was a Senior Research Scientist at Philips Research, Eindhoven, The Netherlands where he led the research efforts on wireless body area networks. From 2004 until 2005, he was a Senior Engineer at Soft.Networks, Atlanta, GA. Dr. Argyriou currently serves in the editorial board of the Journal of Communications. He has also served as guest editor for the IEEE Transactions on Multimedia Special Issue on Quality-Driven Cross-Layer Design, and he was also a lead guest editor for the Journal of Communications, Special Issue on Network Coding and Applications. Dr. Argyriou serves in the TPC of several international conferences and workshops in the area of wireless communications, networking, and signal processing. His current research interests are in the areas of wireless communications, cross-layer wireless system design (with applications in video delivery, sensing, vehicular systems), statistical signal processing theory and applications, optimization, and machine learning. He is a Senior Member of IEEE.
Date: Mar. 12, 2018
Time: 10:15-11:15 am
Place: Innovation Center, Room 2277
Abstract
Data has become the central driving force to new discoveries in science, informed governance, insight into society, and economic growth in the 21st century. Abundant data is a direct result of innovations including the Internet, faster computer processors, cheap storage, the proliferation of sensors, etc, and has the potential to increase business productivity and enable scientific discovery. However, while data is abundant and everywhere, people do not have a fundamental understanding of data. Traditional approaches to decision making under uncertainty are not adequate to deal with massive amounts of data, especially when such data is dynamically changing or becomes available over time. These challenges require novel techniques in data analytics, data-driven optimization, systems modeling and data mining. In this seminar, a number of recent funded data analytics projects will be presented to address various data analytics, mining, modeling, and optimization challenges. In particular, DataBridge, which is a novel data analytics system, will be illustrated.
Dr. Justin Zhan is a professor at the Department of Computer Science, College of Engineering, Department of Radiology, School of Medicine, as well as Nevada Institute of Personalized Medicine. His research interests include Big Data, Information Assurance, Social Computing, Biomedical Computing and Health Informatics. He has been a steering chair of International Conference on Social Computing (SocialCom), and International Conference on Privacy, Security, Risk and Trust (PASSAT). He has been the editor-in-chief of International Journal of Privacy, Security and Integrity and International Journal of Social Computing and Cyber-Physical Systems. He has served as a conference general chair, a program chair, a publicity chair, a workshop chair, or a program committee member for over one-hundred and fifty international conferences and an editor-in-chief, an editor, an associate editor, a guest editor, an editorial advisory board member, or an editorial board member for about thirty journals. He has published more than two hundred articles in peer-reviewed journals and conferences and delivered thirty keynote speeches and invited talks. His research has been extensively funded by National Science Foundation, Department of Defense and National Institute of Health.
Date: Mar. 5, 2018
Time: 10:15-11:15 am
Place: Innovation Center, Room 2277